Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Fee Type Initialization Causes Fee Updates to Break and Charges 10x Intended Fee Rate

casinocompiler

Summary

The FeeCollector.sol contract initializes two fee types (Swap Tax and NFT Royalty) with incorrect basis points values that sum to 20% instead of the intended 2%. Additionally, the updateFeeType function enforces that all fee type parameters must sum to 100% (10000 basis points), making it impossible to update these specific fee types after initialization.

Vulnerability Details

In _initializeFeeTypes, two fee types are initialized with incorrect values:

// Buy/Sell Swap Tax (intended 2% total but actually 20%)
feeTypes[6] = FeeType({
veRAACShare: 500, // 500/10000 = 5%
burnShare: 500, // 500/10000 = 5%
repairShare: 1000, // 1000/10000 = 10%
treasuryShare: 0
});
​
// NFT Royalty Fees (intended 2% total but actually 20%)
feeTypes[7] = FeeType({
veRAACShare: 500, // 500/10000 = 5%
burnShare: 0,
repairShare: 1000, // 1000/10000 = 10%
treasuryShare: 500 // 500/10000 = 5%
});

However, updateFeeType enforces that all parameters must sum to BASIS_POINTS (10000):

if (newFee.veRAACShare + newFee.burnShare + newFee.repairShare + newFee.treasuryShare != BASIS_POINTS) {
revert InvalidDistributionParams();
}

This creates two issues:

  1. The fees are charging 20% instead of the documented 2%

  2. These fee types cannot be updated through updateFeeType since they're intended to sum to 200 basis points (2%) but the function requires 10000 basis points (100%)

Impact

High:

  • Users are charged 10x the intended fee rate (20% vs 2%)

  • Protocol operators cannot update these fee types through normal governance mechanisms

Likelihood

High:

  • Every swap transaction (fee type 6)

  • Every NFT royalty collection (fee type 7)

  • Any attempt to update these fee types

Proof of Code

N/A - Sufficient information in Vulnerability Details

Recommendations

  1. Fix _initializeFeeTypes to the intended fee amount:

// Correct the initialization values for 2% total fee:
feeTypes[6] = FeeType({
veRAACShare: 50, // 0.5%
burnShare: 50, // 0.5%
repairShare: 100, // 1.0%
treasuryShare: 0
});
​
feeTypes[7] = FeeType({
veRAACShare: 50, // 0.5%
burnShare: 0,
repairShare: 100, // 1.0%
treasuryShare: 50 // 0.5%
});

  1. Modify updateFeeType to accept a target total for each fee type rather than enforcing 100%; this will allow more flexible changes and also allow updates to the swap fee and NFT royalty distributions:

function updateFeeType(
uint8 feeType,
FeeType calldata newFee,
uint256 targetTotal
) external {
if (newFee.veRAACShare + newFee.burnShare + newFee.repairShare + newFee.treasuryShare != targetTotal) {
revert InvalidDistributionParams();
}
// rest of function...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!